Antivirus for Chromebook: do you need one, and which security apps run on ChromeOS?

A Chromebook works differently from a Windows PC or a Mac. ChromeOS updates itself, keeps web pages and apps in sandboxes and checks its own software at every startup. That leaves an antivirus app much less to do. What remains is mostly scam pages, add-ons and the date your updates end.

The short answer

For most people, no. Google's malware-removal steps tell Windows users to use antivirus software; for Chromebooks, the step is simply to remove unwanted apps. The core protection is built in and on by default. Google says the default Standard protection covers known dangers, so it may not catch a brand-new fake login page or stop you from approving an extension that asks for too much. And after a Chromebook's update date, security fixes stop.

What ChromeOS does on its own

• Automatic updates: a Chromebook downloads ChromeOS and browser updates by itself whenever it's online; select Restart in the "Update device" notification to finish.
• Sandboxing: Google says each web page and app runs in a restricted environment, so an infected page can't affect other tabs or apps.
• Verified boot: Google says that at every startup the Chromebook checks itself and, if the system was tampered with or corrupted, typically repairs itself — even after automatic updates end.
• Encryption: Google says ChromeOS automatically encrypts user data, and that ChromeOS devices contain a Google security chip that helps verify the hardware and OS are trusted. That doesn't apply to ChromeOS Flex on an old PC: Google says those devices have no Google security chip, so verified boot isn't available.
• Safe Browsing: Chrome's phishing and malware detection is on by default and can show a red "Dangerous site" warning.

Can Chromebooks get viruses?

Google doesn't claim they can't. Its Chromium OS security design starts from the principle that no security solution is ever perfect, and says verified boot isn't expected to detect every attack. The goal is a way back: after a compromise, an update and a reboot should return the system to a known good state. So the advice that matters is about what you let in.

Where the real risks are

• Phishing: scammers use email or text messages to trick you into giving them your personal and financial information, the FTC says.
• Scam pages: Google warns that some sites claim you have a virus to get you to download harmful software, and some lock Chrome to make you believe you must pay to keep using your computer. You don't.
• Extensions, and Android apps from outside Google Play — both covered below.
• Linux apps: Linux is off by default. Once it's on, Google says, all Linux apps run in the same sandbox, so a harmful one can affect other Linux apps but not the rest of your Chromebook — and any files and permissions you share with Linux are available to every Linux app.
• An expired update date: after the final update, a Chromebook no longer gets security updates, bug fixes or new features.

What happens when a Chromebook's updates end?

Google's Auto Update policy promises 10 years of automatic updates, counted from the platform release date, not the day you buy one. Each model still has its own end date, and older Chromebooks stop getting updates sooner, so the date for your model is the one that counts. Google also said in September 2026 that ChromeOS devices get updates and security patches through mid-2034, and that models whose 10 years run past that will be offered a move to Googlebook OS. After the "Final software update" notification, ChromeOS and the browser stop updating, and existing features may stop working. Some pre-2021 models must opt in to their final years of updates, which removes Android apps and the Play Store. Check your date under Settings > About ChromeOS > Additional details, and a model's date in Google's Auto Update policy before you buy; the "End of Sale" date isn't related to Google updates.

Android apps and Google Play Protect

On Chromebooks that support them, Android apps come from the Google Play Store app. Google's Play Protect help page is written for Android devices in general, not specifically for Chromebooks. It says Play Protect checks apps from Google Play before you download them, warns about potentially harmful apps and may deactivate or remove them. It's on by default, and Google recommends always keeping it on: in the Play Store app, open your profile icon, then Play Protect > Settings. You can also control what each Android app can use under Settings > Apps > Manage Google Play preferences > Android settings.

Installing Android apps from anywhere else isn't an everyday setting on a Chromebook. Google's developer guide treats it as a tool for testing apps: you turn on Linux, then ADB debugging, after which ChromeOS warns that the device might have apps that weren't downloaded from the app store. The older route, developer mode, wipes your local data when you switch it on or off and, the Chromium OS developer guide says, makes verified boot a little more lax so the laptop can run software Google hasn't signed. Unless you build apps, leave both off.

Extensions: the add-ons to watch

Google says extensions work like regular programs but run entirely in Chrome, and some ask to read and change all your data on the websites you visit. Chrome shows what an extension can access before you add it; approve only extensions you trust, Google advises. With Enhanced protection on, Chrome warns when an extension isn't trusted. Safety Check, which runs automatically, can also flag extensions that might pose security risks.

• Install extensions only from the Chrome Web Store.
• Remove any you don't need, don't trust or didn't get from there — Google's own malware cleanup step.
• Limit site access on an extension's Details page to when you select it, or to specific sites.
• If something misbehaves, turn extensions off one at a time to find the culprit.

If something's wrong: Powerwash or recover

1. A page locked Chrome and demands payment? Reset the hardware (Refresh + Power if your model isn't on Google's list), sign in, open Chrome and close the "Restore" window — clicking Restore reopens the page.
2. Uninstall apps and extensions you don't recognize.
3. Powerwash: back up first, since a factory reset erases everything on the local drive, including Downloads; files in Google Drive aren't affected. Sign out, press Ctrl + Alt + Shift + R, select Restart, then Powerwash.
4. Recover if you see "ChromeOS is missing or damaged" or nothing else has worked. Recovery reinstalls the OS and permanently erases the drive: press Esc + Refresh (Esc + Maximize on some models), then Power, and recover over the internet (newer models) or from a USB drive of at least 8 GB.
5. Run Google's Security Checkup at myaccount.google.com/security-checkup.
6. On a work or school Chromebook, contact your administrator — you can't reset it yourself.

Does a security app add anything?

Less than on Windows, and nothing that replaces the built-in layers. Before paying for web protection, compare it with Chrome's Enhanced protection. Google says it warns about potentially dangerous sites, downloads and extensions — even ones Google didn't know about before — and about passwords compromised in a data breach. The trade-off is privacy: Chrome sends the URLs you visit, a small sample of page content, extension activity and system information to Google Safe Browsing. Turn it on under Chrome's Settings > Privacy and security > Security.

When can a security suite still make sense?

• The household's other devices are already on one suite, and you want the Chromebook in the same account.
• You'd use extras such as a VPN, a password manager or breach monitoring.
• Someone who uses the Chromebook tends to click through warnings.
• You want one place to see whether every device at home is protected.

Install any security app from Google Play or the Chrome Web Store, and check what it asks to access. It can't stand in for ChromeOS updates. Past the update date, Google says you can keep using the Chromebook but should consider upgrading. No app brings the fixes back.

Antivirus for Chromebook: which security apps run on ChromeOS

If you still want a security app, this is what the brands we review say about Chromebooks on their own support pages and listings, checked October 31, 2026. On a Chromebook, a security app is either an Android app from Google Play or a Chrome extension for web protection, and neither checks all of ChromeOS: McAfee, for example, says its antivirus checks only Android apps and the files the app can access, not every ChromeOS or Linux file.

• McAfee documents Chromebook support most clearly. Its system requirements list ChromeOS 102 and later for McAfee+ and Total Protection, and its Chromebook help article says a supported Chromebook can run the McAfee Security Android app from Google Play; the Chromebook must support Android apps, and a work or school administrator can block Google Play. McAfee lists antivirus, Secure VPN, Wi-Fi Scan, Safe Browsing, identity monitoring and Personal Data Cleanup, depending on the plan and settings, and its FAQ counts Chromebooks among the devices McAfee+ covers.
• Norton's pages disagree. Its system requirements list ChromeOS 72 or later for its Android app from Google Play, while a Norton troubleshooting article says its products are incompatible with Chromebooks. Norton's plan pages list Windows, macOS, Android and iOS, and Norton Safe Web is available as a Chrome extension.
• VirtualShield's help center says its app works on ChromeOS 79 and later from Google Play; the download link there points to the VirtualShield VPN app.
• TotalAV, Avast and Avira don't mention ChromeOS in their system requirements. Each has an Android app on Google Play and a Chrome extension for web protection: Total WebShield, Avast Online Security & Privacy and Avira Browser Safety.

The honest answer doesn't change: most Chromebooks don't need any of these. Google's Chromebook site says no extra antivirus software is needed, and on Chromebooks that support them, Android apps normally come from Google Play, where Google says Play Protect checks apps before you download them. An app makes sense for the reasons in the list above, such as keeping the Chromebook in the same account as the household's other devices; for web protection alone, compare any extension with Chrome's Enhanced protection first.

Chromebook security checklist

1. Restart when "Update device" appears.
2. Know your update date: Settings > About ChromeOS > Additional details.
3. Keep Safe Browsing on, and consider Enhanced protection.
4. Get Android apps only from Google Play, with Play Protect on.
5. Keep extensions few, trusted and limited to the sites they need.
6. Leave Linux and developer mode off unless you need them.
7. Contact companies through a phone number or website you know is real. Real security warnings never ask you to call a number, the FTC says.
8. Back up to Google Drive before you Powerwash or recover.

On a Chromebook, the system mostly looks after itself. Your part is everything around it. Watch what you sign in to, install and approve. And know when your updates end.